Privacy policy

Applies to the PocketTerm apps for Mac, Windows, iPhone and Android published by Danijel Lovric (“the publisher”). Last updated 7 November 2026.

The publisher runs no PocketTerm cloud and never receives what your terminals and coding sessions carry. The apps connect to a PocketTerm server that runs on your own computer. The only thing the publisher operates is an optional relay that forwards encrypted push notifications to Apple and Google.

Where your data lives

Your computers and phones meet in your own PocketTerm server, built into the desktop app on one of your computers. It listens only on that computer, and Tailscale publishes it to your own tailnet, so only your own devices, signed in to your Tailscale account, can reach it. Your other computers join the same server.

Each server serves only its owner's devices. The publisher has no access to any of them. The server keeps:

the device list: each computer's and phone's name and platform, when it signed in and when it was last seen;
your computers' names;
device tokens and pairing codes, only as SHA-256 hashes. A pairing code works once and expires after 10 minutes;
your phones' push tokens, if you turn notifications on, and which sessions each phone follows, by an opaque tag;
for each iPhone Live Activity, its last state and when it went out, until the activity ends (see the push relay below);
sealed images and files on their way to your computer, until the computer downloads them or for at most 1 hour;
after a setup link or pairing code that doesn't work, the address the attempt came from, for 10 minutes, to slow down guessing.

Your server can't read what your terminals carry. Sessions, prompts, the agent's answers, terminal screens, keystrokes, images, files (including their names) and notification text are end-to-end encrypted (AES-256-GCM) with a key that each computer makes for itself. That key never goes to any server: it reaches a phone only inside the QR code the computer shows, scanned with the phone app's scanner. The server passes these messages on without storing them, apart from the sealed images and files above.

No accounts

PocketTerm has no user accounts. A computer signs in to your server with the server's setup link; a phone signs in by scanning a pairing code from a signed-in computer. You can list and sign out your devices in the desktop app's Settings.

Third parties

Tailscale: sees your devices' names and IP addresses and when they connect, under Tailscale's own terms. What PocketTerm sends travels encrypted inside the connection.
Apple and Google (with notifications on): receive your phone's push token and deliver the notifications, under their own privacy terms.
Cloudflare (with notifications on): sits in front of the push relay and sees that your server sent an encrypted request of some size, and the status code.

Earlier test builds

Test builds 0.1.0 to 0.1.7 could also run the server on a VPS you rent or in a project in your own Supabase account. There, your VPS provider or Supabase holds what the server keeps (above) and sees the IP addresses devices connect from, but not what your computers seal. For Supabase setup the desktop app asked for a Supabase access token, used it only during setup and didn't store it. Version 1.0.0 signs such computers and phones out once and sets them up with the server on your computer instead.

The push relay

Notifications are off until you turn them on in the phone app. When they are on, your server sends them through a relay that the publisher runs on his own server in Germany, at push.danyzmaj.com, which forwards them to Apple (APNs) or Google (Firebase Cloud Messaging).

Your computer encrypts each notification with its own key before it leaves. Your server then seals every request to the relay's public key, so only the relay can open it.
The relay sees a push token, the encrypted message, an opaque tag that means nothing without your computer's key, and the time. It never receives computer or session ids, names or notification text.
It stores nothing. It logs one line per push with the platform, the status code and how long it took, never a token, an address or a message. Its rate limits are counters held in memory.
One exception, on iPhone: iOS shows Live Activity updates without running the app's code, so those can't be encrypted. They carry only the session's state (working, needs you, finished or ended), since when, and, when it needs you, whether for a question, an approval or a plan. Never any text, names, folders or ids. While your computer keeps checking in, your server resends the last state quietly so the activity doesn't show as stale.
On Android, a followed session's updates are encrypted like every other notification.

On your devices

So that the Terminal tab can show the last known state before your computer answers, the phone app keeps a copy of the sessions it last showed in its own app storage. A session's copy that hasn't changed for 14 days is deleted, and uninstalling the app removes all of it.
Each device's sign-in and the computers' keys are kept in the Keychain on Mac and iPhone (on iPhone, only on that device and not in backups), in app storage encrypted with a key held in the Android Keystore on Android (excluded from backups and device transfers), and in a file encrypted for your Windows user with DPAPI on Windows. Signing out or leaving the server deletes them.
Images and files you send from the phone are saved on the computer in PocketTerm's own folders in your temporary folder, so the coding agent can read them. Once they are older than a day, they are deleted the next time PocketTerm starts or receives new ones.

Leaving and deleting your data

Sign out in a computer's Settings, or Leave this server in the phone app, ends that device's sign-in and deletes its keys. A computer can also sign out any phone listed in its Settings.
On the computer that runs the server, Erase this server's data signs every device out and deletes everything the server keeps.
If an earlier test build put your server on a VPS, deleting the server's data (docker compose down -v) or the VPS removes it. With Supabase, delete the PocketTerm project in Supabase's dashboard, and the access token if you kept it.
Uninstalling PocketTerm on Windows keeps its data in %APPDATA%\Danijel Lovric\PocketTerm and %USERPROFILE%\.config\pocketterm; delete both folders to remove it.

What the apps send, and to whom

To your server: what is listed above, and the encrypted messages between your computers and phones.
To the push relay (phones' notifications, if you turned them on): what is described above.
To Apple or Google: the phone registers for push notifications with APNs (iPhone) or Firebase Cloud Messaging (Android). The Android app includes Firebase Cloud Messaging only to receive these messages, and no Firebase Analytics or Crashlytics.
Updates: the Mac app checks GitHub Releases for new versions (Sparkle), and the Windows app asks GitHub for the latest release. These requests carry your IP address, as any download does.
Installs you ask for: only when you click to install them and confirm, the Mac app runs Homebrew to install Tailscale or tmux, and the Windows app runs Windows' winget to install Tailscale and downloads the WezTerm installer from WezTerm's GitHub release. Those sources see your IP address.
Tailscale on your computer: the desktop app runs the Tailscale command line on your computer to read its status and publish the server to your tailnet.

The apps contain no analytics, advertising or tracking SDKs, and the publisher doesn't sell or share data, because it doesn't have any.

Permissions

Camera (phones): only to scan the QR code your computer shows. Images from the camera aren't stored or sent.
Photos and files (phones): only the images and files you pick to send to a coding session.
Microphone and speech recognition (phones): only while you dictate a prompt. Speech is turned into text on the phone: on iPhone always on the device, on Android with the phone's on-device recognizer, or, where the phone has none, its speech service asked to stay offline. PocketTerm doesn't store or send the audio; only the text you send reaches your computer.
Notifications (phones): only if you turn them on, for pushes when a session finishes or needs you and for the sessions you follow.
Automation (Mac): only for iTerm2 and Ghostty, to list their windows, read their screens and type what you send from the phone, if you allow it.
Terminal from phone (desktop): while it is on, your signed-in phones can read your computer's coding sessions and terminal windows, prompt them, answer their questions, type into them and open or close windows. It is a switch in Settings.
Launch at login (desktop): off until you turn it on in Settings.

Children

PocketTerm is not directed at children under 13.

This website

The website uses no advertising trackers or cookies. It counts visits with Umami, a cookieless analytics tool hosted on danyzmaj's own server in Germany: the page viewed, the site you came from, your browser, operating system, device type, screen size, language, and approximate location (country, region and city) derived from your IP address. Your IP address itself isn't stored, nothing is saved on your device, and the data isn't shared or sold. The site is hosted on GitHub Pages, which GitHub states logs and stores visitors' IP addresses for security purposes, so hosting itself is not a zero-data service. See GitHub's Privacy Statement.

Support correspondence

If you email support, I receive your email address, your message, and anything you choose to attach. My email provider also processes those messages. I use them to answer questions and fix problems, and I don't add you to a marketing list. Issues you open on GitHub are public and fall under GitHub's terms.

Changes

Changes to this policy are posted on this page with a new date. The apps, the server they set up and the push relay are open source at github.com/danyzmaj-apps/pocketterm, so you can check what they send.

Contact

Questions about this policy: danijel@danyzmaj.com, or open an issue at github.com/danyzmaj-apps/pocketterm/issues. Security reports: please use GitHub's private vulnerability reporting.